Thousands of Websites Hijacked Using Accessibility Feature for Blind or Low Vision People

February 12, 201810:34 am

A massive attack hit thousands of websites around the world, crooks deployed Coinhive scripts forcing them to secretly mine cryptocurrencies on visitors’ browsers.

The list of compromised websites (4275) includes the UK’s NHS, Information Commissioner’s Office (ICO) (ico.org.uk), the UK’s Student Loans Company (slc.co.uk), The City University of New York (cuny.edu), and the US government’s court system. Once the hack was discovered, some sites web down. The ICO also took its website down.

The compromised websites use the Browsealoud plugin which makes their content accessible for blind or low vision people by reading it.

In a time-window of roughly seven hours (between 0300 and 1145 UTC), all the websites using Browsealoud inadvertently ran the Monero cryptocurrency mining code.

The attackers injected an obfuscated version of the mining code in the plugin that once converted from hexadecimal back to ASCII allowed to load the mining code in the webpage.

The alarm was thrown by the security expert Scott Helme who was contacted by a friend who sent him antivirus software warnings received after visiting a UK ICO website.

“This type of attack isn’t new, but this is the biggest I’ve seen. A single company being hacked has meant thousands of sites impacted across the UK, Ireland and the United States,” said Helme.

“Someone just messaged me to say their local government website in Australia is using the software as well.”

“In light of other recent cyber attacks all over the world, we have been preparing for such an incident for the last year and our data security action plan was actioned straight away,” said Texthelp’s chief technology officer Martin McKay in a statement.

“Texthelp has in place continuous automated security tests for Browsealoud, and these detected the modified file and as a result the product was taken offline.”

Texthelp confirmed that, “No customer data has been accessed or lost,” and “customers will receive a further update when the security investigation has been completed.”

The malicious code was removed by 1600 UTC today, the UK’s ICO is currently in a minimal “maintenance” mode as a precaution.

About Nelson Régo

Nelson Régo is the owner and founder of the Cool Blind Tech website since November of 2012. Nelson launched the first show on March 14, 2013. He also directs the website as a whole, hiring staff, originating new shows, and approving all content.

Joel Ramos visits with Alex Lee of Dot Incorporated to get a good look at the new Dot braille smart watch. This gadget has caught a great deal of attention because it brings new possibilities and benefits of the networked digital age to the wrists of millions of Blind & Visually Impaired people worldwide.